Resource analysis and modifications of quantum computing with noisy qubits for elliptic curve discrete logarithms

We estimate the number of physical qubits and execution time by decomposing an implementation of Shor’s algorithm for elliptic curve discrete logarithms into universal gate units at the logical level when surface codes are used. We herein also present modified quantum circuits for elliptic curve discrete logarithms and compare our results with those of the original quantum circuit implementations at the physical level. Through the analysis, we show that the use of more logical qubits in quantum algorithms does not always lead to the use of more physical qubits. We assumed using rotated surface code and logical qubits with all-to-all connectivity. The number of physical qubits and execution time are expressed in terms of bit length, physical gate error rate, and probability of algorithm failure. In addition, we compare our results with the number of physical qubits and execution time of Shor’s factoring algorithm to assess the risk of attack by quantum computers in RSA and elliptic curve cryptography.

. In order to avoid simultaneous CNOT operation, we assumed that the CNOT gates in the red box are performed serially.
Figure 1 shows the circuit of Takahashi adder.The RA uses the Takahashi adder to add the values of the two different quantum states.Although there are many CNOT gates that can be performed simultaneously in the Takahashi adder, our analysis assumes that the CNOT gates are not performed simultaneously to minimize the number of additional logical qubits for lattice-surgery-based CNOT operations.The Takahashi adder serially performs about 5n CNOT gates, 2n toffoli gates.Therefore, the elementary gate step Q TA,serial and T depth D TA,serial of the Takahashi adder are expressed as Q TA,serial = 27n, D TA,serial = 6n. (1) The constant term was ignored as its influence was small.Häner's constant adder includes serial and parallel versions, and the RA uses a serial version of a constant adder.
Figure 2 shows the circuit of constant adder.Let us define Q(A)(T (A)) as the elementary gate step(T depth) of the A operation.Then the elementary gate step and T depth of the constant adder are expressed as Therefore, it is necessary to know the , and D(CARRY (n)) in order to obtain the elementary gate step and T depth of the constant adder.We used CARRY suggested in Häner's work 2 .Assuming the worst case, the n bit CARRY operation, including initialization of the dirty ancilla qubits, serially performs approximately 4n toffoli gates, 2n X gates, and 2n CNOT gates.Therefore, Q(CARRY (n)) = 48n, D(CARRY (n)) = 12n.Similar to Haner's work, we used the incrementor proposed in 3 .The incrementor uses two Takahashi adder and 2n X gates.Because the X gate can be performed simultaneously, The elementary gate step and T depth of Controlled incrementor is the same as incrementor.
Therefore, the elementary gate step Q CA,serial and T depth D CA,serial of the constant adder gate are expressed as A modular constant adder was constructed using two comparators and two constant adders.The comparator described in Häner's work was used.Therefore, the elementary gate step Q MCA and T depth D MCA of the modular adder are expressed as (5) A modular adder is constructed using one comparator, one Takahashi adder, and two constant adders.Therefore, the elementary gate step Q MA and T depth D MA of the modular adder are expressed as In the controlled modular adder, only the Takahashi adder from the modular adder needs to be changed to a controlled version.Therefore, the elementary gate step Q CMA and T depth D CMA of the controlled modular adder are expressed as Modular negation is constructed using one incrementor and a constant adder.The incrementor described in Häner's work was used.Therefore, the elementary gate step Q MN and T depth D MN of modular negation are expressed as Modular multiplication is performed using n-controlled Takahashi adders and n modular constant adders.Therefore, the elementary gate step Q MM and T depth D MM of modular multiplication are expressed as The modular square has the same number of elementary gate steps and T depth as modular multiplication.
The modular inversion in the RA uses a 4n-controlled adder, 16n-triple-controlled doubling, and 8n-triple-controlled adder.As there are two logical qubits that maintain |0⟩ while performing triple-controlled doubling and adders in the modular inversion circuit, we can easily implement triple-controlled operations using these |0⟩ states.For example, CCCCNOT gate using two |0⟩ states can be implemented as shown in Figure 3.
Point addition in the RA uses four modular inversions, four modular multiplications, two modular squares, two modular constant adders, one modular negation, and one controlled modular adder.Therefore, the elementary gate step Q P and T depth D P of point addition are expressed as The RA uses 2n point addition.Therefore, the elementary gate step Q Roe and T depth D Roe of the RA are expressed as: As the CNOT gate is serially executed in the Takahashi adder, there are no cases where two or more CNOT s are executed simultaneously.Thus, N CNOT = 1.In addition, because three T gates are used simultaneously in the Toffoli gate, and because there are no cases where the Toffoli gate is used simultaneously in the entire algorithm, the maximum number of T gates used simultaneously throughout the algorithm is N T = 3.

Decomposition of parallelized constant adder RA at the logical level
We determine the elementary gate step and T depth of the RA when using the parallel constant adder.Throughout the analysis, the constant term was ignored because its influence was small.Unlike in the case of using the serial constant adder, the CNOT gates of the Takahashi adder can be performed in parallel because b n logical qubits have already been prepared to simultaneously perform the CNOT gate.The elementary gate step Q TA,parallel and T depth D TA,parallel of the Takahashi adder are expressed as Because the CNOT s in the Takahashi adder can be performed in parallel, The elementary gate step and T depth of the parallelized constant adder are expressed as Therefore, the elementary gate step Q CA,parallel and T depth D CA,parallel of the parallel constant adder gate are expressed as Using these modifications, we can redefine the elementary gate step and depth of the parallelized constant adder RA.The elementary gate step Q Roe,parallel and T depth D Roe,parallel of the parallelized constant adder RA are expressed as

Decomposition of Takahashi adder version RA at the logical level
We determine the elementary gate step and T depth of the Takahashi addder version RA.As in the RA, it is assumed that the CNOT gate is serially performed on Takahashi adder to minimize N CNOT .The modular p adder in the Takahashi adder version RA is constructed using one comparator and three Takahashi adders.Therefore, the elementary gate step Q MA,p and T depth D MA,p of the modular p adder are expressed as In the controlled modular p adder, only the first Takahashi adder from the modular adder must be changed to a controlled version.Therefore, the elementary gate step Q CMA,p and T depth D CMA,p of the controlled modular p adder are expressed as The modular p negation in Takahashi adder version was constructed using one incrementor and one Takahashi adder.Therefore, the elementary gate step Q MN,p and T depth D MN,p of modular p negation are expressed as Modular p multiplication is constructed using n-controlled Takahashi adders and n modular adders.Therefore, the elementary gate step Q MM,p and T depth D MM,p of modular p multiplication are expressed as The modular p square has the same number of elementary gate steps and T depth as modular multiplication.The point addition in the RA uses 4 modular inversion, 4 modular p multiplication, 2 modular p square, 2 steps of the modular constant adder, 1 modular p negation, and 1 controlled modular p adder.Therefore, the elementary gate step Q P,T and T depth D P,T of point addition are expressed as

Comparison of physical qubit number and required time between RA using Takahashi adder and RA using CDKM adder
Figure 5 shows the circuit of CDKM adder.The CDKM adder serially performs about 3n CNOT gates, 2n toffoli gates.Therefore, the elementary gate step Q CDKM and T depth D CDKM of the Takahashi adder are expressed as Like Takahashi adder version RA, only the constant adder used in the modular p operation are replaced with the CDKM adder.Therefore, the elementary gate step Q Roe,CDKM and T depth D Roe,CDKM of the CDKM adder version RA are expressed as CDKM adder has an advantage in elementary gate step compared to Takahashi adder, but has the disadvantage of requiring the use of one additional logical ancilla qubit.Additionally, since T depth, which has a significant impact on the time required, is the same when using the Takahashi adder and when using the CDKM adder, there is no significant benefit in terms of time.

Figure 1 .
Figure 1.The circuit of Takahashi adder 1 .In order to avoid simultaneous CNOT operation, we assumed that the CNOT gates in the red box are performed serially.

Figure 2 .
Figure 2. The circuit of constant adder.C(n) represents n bit constant adder operation.INC represents incrementor operation.CARRY represents carry operation.The black square represents the ancilla qubits used indirectly in the operation.The triangle inside the box represents the input of the operation, and the triangle outside the box represents the output of the operation.

Figure 5 .
Figure 5.The circuit of CDKM adder 4 .In order to avoid simultaneous CNOT operation, we assumed that the CNOT gates in the red box are performed serially.

Table 1 .
Comparing number of physical qubits and required time of Takahashi adder version RA with CDKM adder version RA.T RA,Tak (N RA,Tak ) represents required time(number of physical qubits) of Takahashi adder version RA and T RA,CDKM (N RA,CDKM ) represents required time(number of physical qubits) of CDKM adder version RA.